Keeping Windows devices on a supported operating system version is an important responsibility for IT administrators. With Microsoft Intune, organizations can control when eligible devices receive Windows 11 version 26H2, deploy it gradually, and monitor the upgrade from one centralized portal.
Windows 11 version 26H2 is Microsoft’s latest annual Windows 11 feature update. It uses the same servicing foundation as Windows 11 versions 24H2 and 25H2. Eligible devices can move to version 26H2 through a smaller enablement package instead of completing a traditional full operating system upgrade. This can provide a faster installation experience, usually requiring only one restart in supported scenarios.
This guide explains the requirements, deployment process, monitoring options, and recommended rollout strategy for Windows 11 version 26H2 using Microsoft Intune.
What Is Windows 11 Version 26H2?
Windows 11 version 26H2 is the next annual feature update for Windows 11. It consolidates Windows features, security improvements, management capabilities, and user-experience changes that Microsoft has delivered through its continuous innovation model.
Because versions 24H2, 25H2, and 26H2 share a common servicing branch, organizations may require less application and device validation than they would for a traditional operating system migration. However, compatibility testing is still necessary for business-critical applications, drivers, security agents, VPN clients, and endpoint management policies. [learn.microsoft.com]
Some of the improvements associated with Windows 11 26H2 include:
- Windows settings backup for eligible commercial devices
- Improved File Explorer navigation and usability
- App-specific actions from the Windows taskbar
- Security and device-management improvements
- Enhancements delivered through monthly quality updates
- An updated Windows security baseline in Microsoft Intune
Microsoft has also introduced a Windows 11 version 26H2 security baseline in Intune. Existing baseline profiles do not automatically move to the new baseline version, so administrators should review the new settings and create or update baseline profiles separately.
Why Deploy Windows 11 26H2 Through Microsoft Intune?
Feature update policies in Microsoft Intune allow administrators to specify the Windows version that managed devices should receive.
A feature update policy can help an organization:
- Upgrade devices to a selected Windows release
- Keep devices on a specific Windows version
- Prevent devices from moving beyond the targeted version
- Coordinate operating system deployment with application testing
- Deploy the update to pilot groups before company-wide rollout
- Monitor update readiness, installation status, and failures
- Offer the update as optional before making it mandatory
Feature update policies can be used alongside Windows update rings, quality-update policies, and driver-update policies. The feature update policy controls the targeted Windows version, while the update ring continues to manage settings such as deadlines, restart behavior, active hours, and user notifications.
Prerequisites for Deploying Windows 11 26H2
Before creating the deployment policy, confirm that the environment and target devices meet Microsoft’s requirements.
1. Required licenses
Organizations need:
- Microsoft Intune Plan 1
- An appropriate Windows license with Windows Autopatch entitlement
The applicable Windows licensing terms must also permit the organization to deploy the selected operating system version.
2. Supported Windows editions
Windows feature update policies support the following editions:
- Windows 11 Pro
- Windows 11 Pro Education
- Windows 11 Enterprise
- Windows 11 Education
Windows Enterprise LTSC is not supported through this feature update policy type. Microsoft recommends using update ring policies for LTSC devices. [learn.microsoft.com]
3. Device enrollment and identity
Target devices must be:
- Enrolled in Microsoft Intune
- Microsoft Entra joined or Microsoft Entra hybrid joined
- Able to communicate with Microsoft Intune and Windows Update services
4. Windows diagnostic data
Windows diagnostic data must be enabled at the required level. Intune uses diagnostic information to provide feature update readiness and deployment reporting.
5. Network connectivity
Devices must be able to access the required:
- Microsoft Intune service endpoints
- Windows Update endpoints
- Windows Autopatch endpoints
Firewall rules, proxy servers, SSL inspection, or web-filtering products should not block the required Microsoft update services. [learn.microsoft.com]
6. Device compatibility
Before deployment, verify that devices meet the Windows 11 hardware requirements, including:
- A supported 64-bit processor
- TPM 2.0
- Secure Boot capability
- At least 4 GB of RAM
- At least 64 GB of storage
- Compatible graphics and firmware
You should also confirm that sufficient disk space is available before assigning the deployment policy.
Prepare Deployment Groups
A phased rollout is safer than assigning Windows 11 26H2 immediately to every managed device.
Consider creating the following Microsoft Entra ID device groups:
- Windows 11 26H2 IT Validation
- Windows 11 26H2 Pilot Users
- Windows 11 26H2 Production Wave 1
- Windows 11 26H2 Production Wave 2
- Windows 11 26H2 Broad Deployment
- Windows 11 26H2 Exclusions
The IT validation group should contain representative hardware models and devices used by the IT department. The pilot group should include users who can provide useful feedback and tolerate minor disruption.
Avoid selecting only high-performance or newly purchased devices for the pilot. Include different manufacturers, hardware models, geographic locations, departments, VPN configurations, and business applications.
Create the Windows 11 26H2 Feature Update Policy
Follow these steps to create the deployment policy.
Step 1: Open the Microsoft Intune admin center
Sign in to the Microsoft Intune admin center with an account that has permission to manage Windows updates.
Step 2: Open Windows update management
Navigate to: Devices > Windows > Manage updates > Windows updates
Select Feature updates, and then select: Create > Create feature update policy
Suggested picture: Windows updates section in the Intune admin center
View the policy-navigation screenshot
Step 3: Configure the deployment settings
Enter a recognizable policy name, such as:
Windows 11 Version 26H2 Feature Update
Add a description that explains the policy’s purpose. For example:
Deploys Windows 11 version 26H2 to approved corporate Windows devices through a controlled rollout.
Under Feature update to deploy, select:
Windows 11, version 26H2
The policy is intended to upgrade supported devices or maintain them at the selected release. It cannot be used to downgrade a device that is already running a newer Windows version.
Step 4: Choose whether the update is optional
Depending on the options available in the tenant, administrators can make the update available to users as an optional update.
When this setting is enabled, users can open:
Settings > Windows Update
They can then select Download & install when Windows 11 version 26H2 is offered.
An optional deployment is useful during the pilot stage because it allows selected users to begin the installation at a convenient time.
For production devices, use the rollout and deadline settings that match the organization’s servicing policy.
Suggested picture: Feature-update deployment settings
View examples of the Windows 11 26H2 policy settings
Step 5: Configure the rollout
Select the rollout option that fits your deployment plan.
For a small pilot group, you can make the update available as soon as possible. For a broader deployment, use separate assignments or rollout waves to limit the number of devices that upgrade at the same time.
| Deployment phase | Recommended duration | Example devices |
|---|---|---|
| IT validation | 7 days | 10 to 25 IT-managed devices |
| Pilot users | 7 to 14 days | 2% to 5% of eligible devices |
| Production Wave 1 | 7 days | 15% to 25% of eligible devices |
| Production Wave 2 | 7 days | 30% to 40% of eligible devices |
| Broad deployment | Based on results | Remaining eligible devices |
The exact percentages should reflect the organization’s size, support capacity, and application risk.
Step 6: Assign the policy
On the Assignments page, select Add groups under Included groups.
Choose the relevant Microsoft Entra ID device group, such as:
Windows 11 26H2 IT Validation
Add an exclusion group if devices with known compatibility issues must not receive the update.
For feature updates, device-based groups are generally preferable because the policy controls the operating system version installed on the device.
Step 7: Review and create the policy
Review the following settings:
- Policy name
- Target Windows version
- Optional or required deployment behavior
- Rollout configuration
- Included device groups
- Excluded device groups
Select Create to save and deploy the policy.
The targeted devices will receive the policy after their next successful Intune check-in.
Configure the Windows Update Ring
The feature update policy selects Windows 11 version 26H2, but the update ring continues to control the installation and restart experience.
Review these Windows update ring settings before broad deployment:
- Automatic update behavior
- Active hours
- Restart checks
- Feature update deadline
- Grace period
- Auto-restart notifications
- User pause permissions
- Option to check for Windows updates
- Delivery Optimization configuration
For example, a production policy might use:
- Feature update deadline: 7 to 14 days
- Grace period: 2 to 3 days
- Auto-restart before deadline: Disabled
- Restart notifications: Enabled
Always test deadline behavior before introducing it to critical or shared devices. An aggressive deadline may restart a device while a user is completing important work.
Force an Intune Sync on a Test Device
To accelerate testing on a selected device, initiate a manual synchronization.
On the Windows device, open:
Settings > Accounts > Access work or school
Select the connected work account, choose Info, and then select Sync.
You can also initiate a synchronization from the Intune admin center:
- Open Devices > Windows.
- Select the test device.
- Select Sync.
- Wait for the device to check in and evaluate the assigned update policies.
Policy availability does not necessarily mean the update will install immediately. Windows Update must still evaluate compatibility, safeguard holds, disk space, and other deployment conditions.
Monitor the Windows 11 26H2 Deployment
After assigning the feature update policy, monitor its status through Intune.
Navigate to:
Reports > Windows updates > Reports
Select Windows Feature Update Report.
Choose the Windows 11 26H2 feature update policy and generate the report.
The report can help identify devices that are:
- Eligible for the update
- In progress
- Successfully updated
- Pending a restart
- Blocked by a safeguard hold
- Experiencing an installation error
- Not offering sufficient reporting data
Administrators should not measure success only by checking whether the policy was assigned. Confirm that the expected Windows version is installed and that key business applications continue to function.
Validate the End-User Experience
On a targeted device, open:
Settings > Windows Update
If the policy makes Windows 11 26H2 optional, the user should see the update with a Download & install option.
During validation, confirm:
- The update appears on the device
- The download begins successfully
- Installation finishes without errors
- The restart notification is displayed correctly
- The device returns to the Windows sign-in screen
- BitLocker recovery is not unexpectedly triggered
- VPN, Wi-Fi, printers, cameras, and docking stations work
- Microsoft 365 applications open correctly
- Security and management agents remain healthy
- The device reports the correct version to Intune
To review the installed version, enter winver in the Windows search box and open the command.
Common Deployment Problems
The update is not offered
Possible causes include:
- The feature update policy has not reached the device
- The device is not included in the assigned Microsoft Entra group
- Another update policy is targeting a different Windows version
- Windows diagnostic data is disabled
- Required Microsoft endpoints are blocked
- The device is subject to a safeguard hold
- The current operating system or edition is unsupported
- The device has insufficient disk space
Start by checking the device’s last Intune check-in, assigned policies, Windows edition, update report, and Windows Update logs.
The device remains on the existing version
A feature update policy can maintain a device at a target Windows version, but installation still depends on Windows Update eligibility.
Check:
- Hardware compatibility
- Safeguard holds
- Pending restarts
- Update ring deferrals
- Feature-update deadlines
- Conflicting Group Policy settings
- Windows Update for Business registry values
- Proxy and firewall connectivity
The policy reports an error
Record the displayed error code and review:
- Intune feature update reports
- Windows Update logs
- Event Viewer
- DeviceManagement-Enterprise-Diagnostics-Provider logs
- Microsoft Entra join status
- Intune management extension and MDM status
For deeper troubleshooting, generate the Windows Update log by running the following PowerShell command:
Get-WindowsUpdateLog
This creates a readable Windows Update log that can help identify scan, download, compatibility, and installation problems.
Recommended Deployment Best Practices
Use a phased rollout
Never begin with all production devices unless the environment is extremely small and the risk has been evaluated.
Test critical applications
Validate ERP software, VPN clients, endpoint protection tools, browser extensions, printing solutions, smart-card components, and legacy applications.
Create an exclusion group
Maintain a dynamic or assigned exclusion group for incompatible hardware, critical systems, shared devices, and computers under investigation.
Coordinate with the help desk
Provide support teams with:
- The rollout dates
- Expected user prompts
- Known issues
- Basic troubleshooting steps
- Escalation procedures
- Relevant error codes
- Rollback or recovery guidance
Review the new security baseline separately
The Windows 11 version 26H2 security baseline is available in Intune, but existing baseline profiles do not update automatically. Test the new baseline in a dedicated group and compare new or changed settings before production assignment. [learn.microsoft.com]
Monitor after installation
Continue monitoring devices after they report a successful upgrade. Some compatibility problems appear only after users begin working with business applications, peripherals, authentication systems, or remote-access tools.
Final Thoughts
Deploying Windows 11 version 26H2 through Microsoft Intune gives administrators greater control over Windows servicing. Feature update policies can target a specific Windows release, prevent unexpected version changes, and provide reporting that helps IT teams track deployment progress.
Although 26H2 uses the same servicing foundation as Windows 11 versions 24H2 and 25H2, organizations should still test applications, drivers, security policies, and user workflows. A staged deployment that begins with IT validation and pilot groups provides the safest route to a successful production rollout